martbost
dea279eed0
Every account gets a share code at signup; /join/<code> attributes first-touch site-side and resolves to the referrer's CURRENT on-chain id at the referral's buy time, so activating any time before your people buy locks the line to you. Joining through a code emails the referrer an activate-payouts nudge. Buy flow re-resolves the sponsor at click time. Copy updated across home and members; assets bumped to v=20260904g. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
385 lines
19 KiB
JavaScript
385 lines
19 KiB
JavaScript
// InstantAdPay — membership advertising with immutable on-chain settlement.
|
|
// Zero-dependency Node server (RM Circle pattern): static pages + JSON API,
|
|
// wallet sign-in (SIWE), live contract ledger, sponsor join links.
|
|
//
|
|
// Chain selection (Amoy rehearsal vs mainnet) lives in data/config.json —
|
|
// see chain.js. Wipe the volume's accounts/sessions + flip config = launch.
|
|
const http = require('http');
|
|
const fs = require('fs');
|
|
const path = require('path');
|
|
const { URL } = require('url');
|
|
const chain = require('./chain');
|
|
const auth = require('./auth');
|
|
const accounts = require('./accounts');
|
|
const ads = require('./ads');
|
|
const mailer = require('./mailer');
|
|
|
|
const PORT = Number(process.env.PORT || 3000);
|
|
const ROOT = __dirname;
|
|
const PUBLIC_DIR = path.join(ROOT, 'public');
|
|
const DATA_DIR = process.env.DATA_DIR || path.join(ROOT, 'data');
|
|
const ADMIN_PASSWORD = process.env.ADMIN_PASSWORD || 'changeme';
|
|
const IS_PROD = process.env.NODE_ENV === 'production';
|
|
const SITE_FILE = path.join(DATA_DIR, 'site.json');
|
|
|
|
fs.mkdirSync(DATA_DIR, { recursive: true });
|
|
chain.init({ onEvent: ev => pushFeed(ev) });
|
|
auth.init({ dataDir: DATA_DIR, chain, isProd: IS_PROD, site: 'instantadpay.com' });
|
|
accounts.init({ dataDir: DATA_DIR });
|
|
ads.init({ dataDir: DATA_DIR, chain });
|
|
mailer.init({ dataDir: DATA_DIR });
|
|
// magic-code sign-in: emailLower -> {code, exp, tries}
|
|
const emailCodes = new Map();
|
|
setTimeout(() => ads.dailySweep(), 60 * 1000);
|
|
setInterval(() => ads.dailySweep(), 60 * 60 * 1000); // login-ad daily charges
|
|
|
|
function siteConfig() {
|
|
let saved = {};
|
|
try { saved = JSON.parse(fs.readFileSync(SITE_FILE, 'utf8')); } catch (e) {}
|
|
return Object.assign({
|
|
siteName: 'InstantAdPay',
|
|
tagline: 'Advertise and earn. Locked in code, not promises.',
|
|
rehearsal: true // shows the testnet banner; flipped off at mainnet launch
|
|
}, saved);
|
|
}
|
|
|
|
// ---- helpers ----
|
|
const MIME = { '.html': 'text/html; charset=utf-8', '.css': 'text/css', '.js': 'text/javascript',
|
|
'.png': 'image/png', '.jpg': 'image/jpeg', '.svg': 'image/svg+xml', '.webp': 'image/webp',
|
|
'.ico': 'image/x-icon', '.json': 'application/json', '.mp4': 'video/mp4', '.woff2': 'font/woff2' };
|
|
const CSP = "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com; img-src 'self' data: https:; connect-src 'self'; font-src 'self' data: https://fonts.gstatic.com; form-action 'self'";
|
|
function baseHeaders(extra) {
|
|
return Object.assign({ 'Content-Security-Policy': CSP, 'X-Content-Type-Options': 'nosniff',
|
|
'Referrer-Policy': 'strict-origin-when-cross-origin' }, extra || {});
|
|
}
|
|
function json(res, code, obj, extra) {
|
|
const body = JSON.stringify(obj);
|
|
res.writeHead(code, baseHeaders(Object.assign({ 'Content-Type': 'application/json', 'Cache-Control': 'no-store' }, extra)));
|
|
res.end(body);
|
|
}
|
|
function sendFile(res, file) {
|
|
fs.readFile(file, (err, data) => {
|
|
if (err) { res.writeHead(404, baseHeaders({ 'Content-Type': 'text/plain' })); return res.end('Not found'); }
|
|
const ext = path.extname(file).toLowerCase();
|
|
res.writeHead(200, baseHeaders({ 'Content-Type': MIME[ext] || 'application/octet-stream',
|
|
'Cache-Control': ext === '.html' ? 'no-cache' : 'public, max-age=3600' }));
|
|
res.end(data);
|
|
});
|
|
}
|
|
function readBody(req) {
|
|
return new Promise((resolve, reject) => {
|
|
let d = ''; let n = 0;
|
|
req.on('data', c => { n += c.length; if (n > 64 * 1024) { req.destroy(); reject(new Error('too big')); } d += c; });
|
|
req.on('end', () => { try { resolve(d ? JSON.parse(d) : {}); } catch (e) { reject(e); } });
|
|
req.on('error', reject);
|
|
});
|
|
}
|
|
function parseCookies(req) {
|
|
const out = {};
|
|
for (const p of (req.headers.cookie || '').split(';')) {
|
|
const i = p.indexOf('='); if (i > 0) out[p.slice(0, i).trim()] = decodeURIComponent(p.slice(i + 1).trim());
|
|
}
|
|
return out;
|
|
}
|
|
function isAdmin(req) {
|
|
const h = req.headers.authorization || '';
|
|
return h === 'Bearer ' + ADMIN_PASSWORD;
|
|
}
|
|
// A sponsor token is a numeric chain id or a site share code. Codes resolve
|
|
// to the referrer's CURRENT chain id, so activation any time before the
|
|
// referral's first purchase still locks the line to them.
|
|
async function resolveSponsorToken(tok) {
|
|
const t = String(tok || '').trim().toLowerCase();
|
|
if (!t) return 0;
|
|
if (/^\d+$/.test(t)) return Number(t);
|
|
const acct = accounts.byCode(t);
|
|
if (!acct || !acct.address) return 0;
|
|
try { return await chain.memberIdByAccount(acct.address); } catch (e) { return 0; }
|
|
}
|
|
// The moment someone joins through a code, nudge its owner to activate.
|
|
function nudgeReferrer(ref) {
|
|
try {
|
|
const t = String(ref || '').trim().toLowerCase();
|
|
if (!t || /^\d+$/.test(t) || !mailer.hasKey()) return;
|
|
const owner = accounts.byCode(t);
|
|
if (!owner || !owner.email || owner.address) return; // already activated-ready
|
|
mailer.send(owner.email, 'Someone just joined through your InstantAdPay link',
|
|
'Good news: a new member just signed up through your share link.\n\n'
|
|
+ 'One thing to do so you never miss a payment: sign in and switch on payouts '
|
|
+ '(one free wallet step). The contract locks each buyer to their sponsor at their '
|
|
+ 'first purchase, so have payouts on before your people start buying.\n\n'
|
|
+ 'https://instantadpay.com/my\n\nInstantAdPay').catch(e => console.error('nudge failed', e.message));
|
|
} catch (e) {}
|
|
}
|
|
|
|
// ---- live feed (SSE) ----
|
|
const feedClients = new Set();
|
|
function pushFeed(ev) {
|
|
const line = 'data: ' + JSON.stringify(ev) + '\n\n';
|
|
for (const res of feedClients) { try { res.write(line); } catch (e) { feedClients.delete(res); } }
|
|
}
|
|
|
|
// ---- server ----
|
|
const server = http.createServer(async (req, res) => {
|
|
try {
|
|
const u = new URL(req.url, 'http://x');
|
|
const p = u.pathname;
|
|
|
|
// -- join links: /join/<memberId or share code> — first-touch cookie.
|
|
// Codes resolve LATE (at buy time) to whatever chain id the referrer
|
|
// has by then, so free members refer from day one.
|
|
let m = /^\/join\/([A-Za-z0-9]{1,16})$/.exec(p);
|
|
if (m && req.method === 'GET') {
|
|
const tok = m[1].toLowerCase();
|
|
const cookies = parseCookies(req);
|
|
const headers = { Location: '/' };
|
|
if (!cookies['iap.sponsor']) {
|
|
headers['Set-Cookie'] = `iap.sponsor=${tok}; Path=/; SameSite=Lax; Max-Age=${180 * 24 * 3600}${IS_PROD ? '; Secure' : ''}`;
|
|
}
|
|
res.writeHead(302, baseHeaders(headers));
|
|
return res.end();
|
|
}
|
|
|
|
// -- public API
|
|
if (p === '/api/config' && req.method === 'GET') {
|
|
const c = chain.getConfig();
|
|
return json(res, 200, Object.assign({ contract: c.contract, chainId: c.chainId,
|
|
chainName: c.chainName, explorer: c.explorer, rpc: c.rpcs[0],
|
|
emailAuth: mailer.hasKey() || !IS_PROD }, siteConfig()));
|
|
}
|
|
if (p === '/api/catalog' && req.method === 'GET') {
|
|
return json(res, 200, { products: await chain.catalog() });
|
|
}
|
|
if (p === '/api/feed' && req.method === 'GET') {
|
|
return json(res, 200, { events: chain.recentEvents(Number(u.searchParams.get('n')) || 100) });
|
|
}
|
|
if (p === '/api/feed/live' && req.method === 'GET') {
|
|
res.writeHead(200, baseHeaders({ 'Content-Type': 'text/event-stream', 'Cache-Control': 'no-store', Connection: 'keep-alive' }));
|
|
res.write(': connected\n\n');
|
|
feedClients.add(res);
|
|
req.on('close', () => feedClients.delete(res));
|
|
return;
|
|
}
|
|
if (p === '/api/sponsor' && req.method === 'GET') {
|
|
const tok = parseCookies(req)['iap.sponsor'] || '';
|
|
const sponsorId = await resolveSponsorToken(tok);
|
|
return json(res, 200, { ref: tok, sponsorId, invited: !!tok });
|
|
}
|
|
if (p === '/api/stats' && req.method === 'GET') {
|
|
let members = 0; try { members = await chain.memberCount(); } catch (e) {}
|
|
return json(res, 200, Object.assign({ onchainMembers: members, siteAccounts: accounts.count() }, chain.totals()));
|
|
}
|
|
|
|
// -- accounts: email + password is the normal join path (wallet comes
|
|
// out only at purchase / payout-activation time and gets linked then)
|
|
if (p === '/api/signup' && req.method === 'POST') {
|
|
const b = await readBody(req);
|
|
const ref = parseCookies(req)['iap.sponsor'] || ''; // first-touch attribution
|
|
const r = accounts.signup(b.email, b.password, ref);
|
|
if (r.error) return json(res, 400, r);
|
|
nudgeReferrer(ref);
|
|
const token = auth.mintSession({ email: r.account.email });
|
|
return json(res, 200, { ok: true, account: r.account }, { 'Set-Cookie': auth.sessionCookie(token) });
|
|
}
|
|
if (p === '/api/login' && req.method === 'POST') {
|
|
const b = await readBody(req);
|
|
const r = accounts.login(b.email, b.password);
|
|
if (r.error) return json(res, 400, r);
|
|
let memberId = 0;
|
|
if (r.account.address) { try { memberId = await chain.memberIdByAccount(r.account.address); } catch (e) {} }
|
|
const token = auth.mintSession({ email: r.account.email, address: r.account.address, memberId });
|
|
return json(res, 200, { ok: true, account: r.account }, { 'Set-Cookie': auth.sessionCookie(token) });
|
|
}
|
|
|
|
// -- passwordless: email code sign-in (signup and login are the same act)
|
|
if (p === '/api/auth/email/start' && req.method === 'POST') {
|
|
const b = await readBody(req);
|
|
const e = String(b.email || '').trim().toLowerCase();
|
|
if (!/^[^\s@]+@[^\s@]+\.[^\s@]{2,}$/.test(e)) return json(res, 400, { error: 'That email address does not look right.' });
|
|
const prev = emailCodes.get(e);
|
|
if (prev && Date.now() < prev.nextAt) return json(res, 429, { error: 'Code already sent. Give it a minute, then try again.' });
|
|
const code = String(Math.floor(100000 + Math.random() * 900000));
|
|
emailCodes.set(e, { code, exp: Date.now() + 15 * 60 * 1000, tries: 0, nextAt: Date.now() + 60 * 1000 });
|
|
if (mailer.hasKey()) {
|
|
try { await mailer.sendCode(e, code); } catch (err) {
|
|
console.error('sendCode failed', err.message);
|
|
return json(res, 502, { error: 'Could not send the email. Try again in a minute.' });
|
|
}
|
|
return json(res, 200, { ok: true, sent: true });
|
|
}
|
|
if (!IS_PROD) return json(res, 200, { ok: true, sent: false, devCode: code });
|
|
return json(res, 503, { error: 'Email sign-in is not configured yet.' });
|
|
}
|
|
if (p === '/api/auth/email/verify' && req.method === 'POST') {
|
|
const b = await readBody(req);
|
|
const e = String(b.email || '').trim().toLowerCase();
|
|
const rec = emailCodes.get(e);
|
|
if (!rec || rec.exp < Date.now()) return json(res, 400, { error: 'Code expired. Request a fresh one.' });
|
|
rec.tries += 1;
|
|
if (rec.tries > 6) { emailCodes.delete(e); return json(res, 400, { error: 'Too many tries. Request a fresh code.' }); }
|
|
if (String(b.code || '').trim() !== rec.code) return json(res, 400, { error: 'That code does not match.' });
|
|
emailCodes.delete(e);
|
|
const ref = parseCookies(req)['iap.sponsor'] || '';
|
|
const r = accounts.ensure(e, ref); // first touch wins; existing accounts unchanged
|
|
if (r.error) return json(res, 400, r);
|
|
if (r.created) nudgeReferrer(ref);
|
|
let memberId = 0;
|
|
if (r.account.address) { try { memberId = await chain.memberIdByAccount(r.account.address); } catch (err) {} }
|
|
const token = auth.mintSession({ email: r.account.email, address: r.account.address, memberId });
|
|
return json(res, 200, { ok: true, account: r.account }, { 'Set-Cookie': auth.sessionCookie(token) });
|
|
}
|
|
|
|
// -- wallet auth: link-to-account when an email session exists, or
|
|
// wallet-first sign-in for crypto-native users
|
|
if (p === '/api/auth/challenge' && req.method === 'POST') {
|
|
const b = await readBody(req);
|
|
const r = auth.makeChallenge(b.address);
|
|
return json(res, r.error ? 400 : 200, r);
|
|
}
|
|
if (p === '/api/auth/verify' && req.method === 'POST') {
|
|
const b = await readBody(req);
|
|
const r = await auth.verifyChallenge(b.address, b.signature);
|
|
if (r.error) return json(res, 400, r);
|
|
let memberId = 0;
|
|
try { memberId = await chain.memberIdByAccount(r.address); } catch (e) {}
|
|
const s = auth.fromRequest(req);
|
|
if (s && s.email) {
|
|
const lr = accounts.linkWallet(s.email, r.address);
|
|
if (lr.error) return json(res, 400, lr);
|
|
auth.updateSession(s.token, { address: r.address, memberId });
|
|
return json(res, 200, { ok: true, linked: true, address: r.address, memberId });
|
|
}
|
|
const acct = accounts.byAddress(r.address);
|
|
const token = auth.mintSession({ email: acct ? acct.email : null, address: r.address, memberId });
|
|
return json(res, 200, { ok: true, address: r.address, memberId },
|
|
{ 'Set-Cookie': auth.sessionCookie(token) });
|
|
}
|
|
if (p === '/api/auth/logout' && req.method === 'POST') {
|
|
auth.logout(req);
|
|
return json(res, 200, { ok: true }, { 'Set-Cookie': auth.clearCookie() });
|
|
}
|
|
if (p === '/api/me' && req.method === 'GET') {
|
|
const s = auth.fromRequest(req);
|
|
if (!s) return json(res, 200, { signedIn: false });
|
|
const memberId = await auth.refreshMemberId(s);
|
|
const acct = (s.email && accounts.byEmail(s.email)) || (s.address && accounts.byAddress(s.address)) || null;
|
|
const sponsorId = await resolveSponsorToken((acct && acct.sponsorRef) || parseCookies(req)['iap.sponsor']);
|
|
const out = { signedIn: true, email: s.email || (acct && acct.email) || null,
|
|
address: s.address || (acct && acct.address) || null, memberId,
|
|
refCode: (acct && acct.code) || null, sponsorId };
|
|
if (memberId) {
|
|
try {
|
|
const mm = await chain.member(memberId);
|
|
out.buyerCount = mm.buyerCount;
|
|
out.onchainSponsorId = mm.sponsorId;
|
|
out.credits = await chain.creditBalance(memberId, 0);
|
|
} catch (e) { out.chainReadError = true; }
|
|
}
|
|
return json(res, 200, out);
|
|
}
|
|
|
|
if (p === '/api/my/activity' && req.method === 'GET') {
|
|
const s = auth.fromRequest(req);
|
|
if (!s) return json(res, 401, { error: 'Sign in first.' });
|
|
const id = s.memberId || await auth.refreshMemberId(s);
|
|
if (!id) return json(res, 200, { memberId: 0, earnings: [], purchases: [], referrals: [] });
|
|
const evs = chain.recentEvents(600);
|
|
return json(res, 200, {
|
|
memberId: id,
|
|
earnings: evs.filter(e => (e.type === 'TierPaid' && e.recipientId === id) || (e.type === 'AwardPaid' && e.toId === id)),
|
|
purchases: evs.filter(e => e.type === 'Purchase' && e.buyerId === id),
|
|
referrals: evs.filter(e => (e.type === 'MemberActivated' && e.sponsorId === id) || (e.type === 'BuyerCounted' && e.sponsorId === id))
|
|
});
|
|
}
|
|
|
|
// -- ad engine (spec §8b v1: banners, text, login ads)
|
|
if (p === '/api/ads/slot' && req.method === 'GET') {
|
|
const ad = ads.serve(String(u.searchParams.get('type') || 'banner'));
|
|
return json(res, 200, { ad });
|
|
}
|
|
m = /^\/api\/ads\/click\/(\d+)$/.exec(p);
|
|
if (m && req.method === 'GET') {
|
|
const target = ads.click(m[1]);
|
|
if (!target) { res.writeHead(404, baseHeaders()); return res.end(); }
|
|
res.writeHead(302, baseHeaders({ Location: target }));
|
|
return res.end();
|
|
}
|
|
if (p === '/api/my/campaigns' && req.method === 'GET') {
|
|
const s = auth.fromRequest(req);
|
|
if (!s || !s.email) return json(res, 401, { error: 'Sign in first.' });
|
|
const memberId = await auth.refreshMemberId(s);
|
|
const out = { campaigns: ads.listCampaigns(s.email), rates: ads.rates() };
|
|
out.availableCredits = memberId ? await ads.availableCredits(memberId) : 0;
|
|
return json(res, 200, out);
|
|
}
|
|
if (p === '/api/my/campaigns' && req.method === 'POST') {
|
|
const s = auth.fromRequest(req);
|
|
if (!s || !s.email) return json(res, 401, { error: 'Sign in first.' });
|
|
const memberId = await auth.refreshMemberId(s);
|
|
if (!memberId) return json(res, 400, { error: 'Buy an ad package first. Campaigns spend the on-chain credits it mints.' });
|
|
const b = await readBody(req);
|
|
const r = await ads.createCampaign(s.email, memberId, b);
|
|
return json(res, r.error ? 400 : 200, r);
|
|
}
|
|
m = /^\/api\/my\/campaigns\/(\d+)\/(pause|resume)$/.exec(p);
|
|
if (m && req.method === 'POST') {
|
|
const s = auth.fromRequest(req);
|
|
if (!s || !s.email) return json(res, 401, { error: 'Sign in first.' });
|
|
const r = ads.setStatus(s.email, m[1], m[2] === 'pause' ? 'paused' : 'active');
|
|
return json(res, r.error ? 400 : 200, r);
|
|
}
|
|
|
|
// -- admin (Bearer ADMIN_PASSWORD)
|
|
if (p === '/api/admin/burns' && req.method === 'GET') {
|
|
if (!isAdmin(req)) return json(res, 401, { error: 'auth' });
|
|
return json(res, 200, { pending: ads.pendingBurns() });
|
|
}
|
|
if (p === '/api/admin/burns/mark' && req.method === 'POST') {
|
|
if (!isAdmin(req)) return json(res, 401, { error: 'auth' });
|
|
const b = await readBody(req);
|
|
const r = ads.markBurned(b.id, b.tx);
|
|
return json(res, r.error ? 400 : 200, r);
|
|
}
|
|
if (p === '/api/admin/rates' && req.method === 'PATCH') {
|
|
if (!isAdmin(req)) return json(res, 401, { error: 'auth' });
|
|
const b = await readBody(req);
|
|
return json(res, 200, { ok: true, rates: ads.setRates(b) });
|
|
}
|
|
|
|
if (p === '/api/admin/site' && req.method === 'PATCH') {
|
|
if (!isAdmin(req)) return json(res, 401, { error: 'auth' });
|
|
const b = await readBody(req);
|
|
const cur = siteConfig();
|
|
fs.writeFileSync(SITE_FILE, JSON.stringify(Object.assign(cur, b), null, 2));
|
|
return json(res, 200, { ok: true, site: siteConfig() });
|
|
}
|
|
if (p === '/api/admin/chain' && req.method === 'PATCH') {
|
|
if (!isAdmin(req)) return json(res, 401, { error: 'auth' });
|
|
const b = await readBody(req);
|
|
const file = path.join(DATA_DIR, 'config.json');
|
|
let cur = {}; try { cur = JSON.parse(fs.readFileSync(file, 'utf8')); } catch (e) {}
|
|
fs.writeFileSync(file, JSON.stringify(Object.assign(cur, b), null, 2));
|
|
chain.reloadConfig();
|
|
return json(res, 200, { ok: true, config: chain.getConfig() });
|
|
}
|
|
|
|
// -- pages
|
|
if (req.method === 'GET') {
|
|
if (p === '/') return sendFile(res, path.join(PUBLIC_DIR, 'index.html'));
|
|
if (p === '/ledger') return sendFile(res, path.join(PUBLIC_DIR, 'ledger.html'));
|
|
if (p === '/contract') return sendFile(res, path.join(PUBLIC_DIR, 'contract.html'));
|
|
if (p === '/my') return sendFile(res, path.join(PUBLIC_DIR, 'my.html'));
|
|
const safe = path.normalize(p).replace(/^([.\\/])+/, '');
|
|
const file = path.join(PUBLIC_DIR, safe);
|
|
if (file.startsWith(PUBLIC_DIR) && fs.existsSync(file) && fs.statSync(file).isFile()) return sendFile(res, file);
|
|
}
|
|
|
|
res.writeHead(404, baseHeaders({ 'Content-Type': 'text/plain' }));
|
|
res.end('Not found');
|
|
} catch (e) {
|
|
console.error('request error', req.url, e.message);
|
|
try { json(res, 500, { error: 'server error' }); } catch (_) {}
|
|
}
|
|
});
|
|
server.listen(PORT, () => console.log(`InstantAdPay site on :${PORT} — chain: ${chain.getConfig().chainName}`));
|